CODEWITHSUNDEEP
pdfdigital-signature
Bardo
Bardo

Reputation: 2523

We receive signed PDF documents with ulterior modifications

Maybe this one would fit better on so security? I'm not sure...

These are the facts:

Now, this goes against my general perception of electronic signature functionality. If any change is made to the document (or the data loaded into it) after I make a signature, this signature should become invalid, as the document has been altered.

The behaviour of the PDF seems to be different, as not only the signature still is valid, also the "default version" that you see when you open the document is the last one, not the signed one.

Now I'm wondering

If this is a defined behaviour, how do you deal with it?

Upvotes: 0

Views: 108

Answers (1)

mkl
mkl

Reputation: 95898

Now, this goes against my general perception of electronic signature functionality. If any change is made to the document (or the data loaded into it) after I make a signature, this signature should become invalid, as the document has been altered.

The behaviour of the PDF seems to be different, as not only the signature still is valid, also the "default version" that you see when you open the document is the last one, not the signed one.

Is this some kind of bug or is a expected behaviour?

It is expected behavior. You have to be aware of two special factors here:

  • A PDF signature field contains the information of the byte ranges signed. Obviously not the whole file can be signed as the signature itself is embedded and cannot be part of the signed bytes. Thus, the signed bytes ranges need to be recorded somewhere. Cf. this answer on Information Security Stack Exchange:

  • Additions to a PDF can be made by appending to the existing document, a process called an incremental update. These updates can again be signed etc., also cf. the answer referenced above:

Thus, making changes to a PDF by means of an incremental update, the existing integrated signatures in the document still correctly sign their respective signed by range. They still are mathematically valid in spite of the added changes.

Furthermore the current contents of a PDF are defined in particular by the newest incremental update, so when you open the document it shows the content including the last changes, not the signed one.

Now, while this sounds like PDF signatures have no meaning, this is not the case. The specification ISO 32000-1 clearly defines which changes are allowed to be made in an incremental update to a certified (= signed with some special flags) base version of a document, and Adobe in their Acrobat and Reader software have extrapolated restrictions from this for signed but not certified documents, cf. this answer on stack overflow.

In particular at most the following changes are allowed:

  • Adding signature fields
  • Adding or editing annotations
  • Supplying form field values
  • Digitally signing

If this is a defined behaviour, how do you deal with it?

As the documents originate from you, you can start by applying a certificate signature to the document which only allows as little changes as possible in your use case.

Then you can define signature lock information for the signature fields your users are to sign. In these lock information you can e.g. prescribe that after signing the given signature field, a number of form fields shall be read-only.

Finally you only accept back PDFs which still contain your certification signature and to which no disallowed changes were added.

There actually are numerous PDFs which are certified and contain a number of fields for additional approval signatures, and each of the approval signature fields is coupled with some form fields which will not be editable anymore after signing. After all the signature fields are signed, all fields are read-only.

There is any place where info on the matter can be found? (google keeps redirecting me once and again to "how to sign a PDF" articles).

You should in particular look at the PDF specification ISO 32000-1 and some Adobe documents on the behavior of their software. You'll find links at the bottom of the stack overflow documentation page the above mentioned links point to.

Upvotes: 2

Related Questions